Tornado Cash Suffers Another Governance Attack: A Fake Proposal Targets $23 Million Community Treasury

Foresight NewsPublicado a 2026-06-26Actualizado a 2026-06-26

Resumen

On June 25, 2026, a deceptive governance proposal (#67) appeared in the Tornado Cash DAO, masquerading as an upgrade to implement fee adjustments and token burns. Security researchers, including Sergey Shemyakov and Pascal Caversaccio, quickly identified it as malicious. The proposal's unverified code contained a hidden function designed to stealthily replace the protocol's legitimate governance address (0x5efda50f22d34F262c29268506C5Fa42cB56A1Ce) with an attacker-controlled address (0x5efda50f22d34f272c7077689d6abc42f15e285f). If passed, this would have granted the attacker control over the DAO's treasury, containing approximately $23 million in TORN tokens, and the ability to drain all relayers. The attacker's wallet (0xd4eca8c9242b9f9faa3cf19a78defc21dc97a925) was funded via the privacy protocol Railgun four days prior, obscuring the source. The community response was swift, with the proposal receiving 27,163 TORN votes against (100%) and 0 for, far below the 100,000 TORN quorum required for validity. It is set to expire on June 30. This incident marks the second major governance attack on Tornado Cash, following a May 2023 exploit that stole $2.17 million. It highlights persistent vulnerabilities in DAO structures where power derives from token ownership. The article advises users to follow security researchers, vote against unverified proposals, and delegate voting power. For developers, implementing timelocks—a delay between proposal approval and execution—is presente...

Author: angelilu, Foresight News

At 6:18 AM on June 25, 2026, a governance proposal numbered 67 appeared on the voting page of the Tornado Cash DAO.

The title was written formally: "Establishing a 0.5% Fee Standard and 90% Dynamic Deflationary Burn Scheme." The main text was lengthy and elaborate, claiming to upgrade the relayer registry to the "V5 Strategy A" architecture, permanently burning 90% of the protocol fees, distributing 10% to stakers, and including a set of economic model projections for a "positive wealth cycle."

The proposer also requested 50 TORN tokens from the treasury to compensate for the Gas fees prepaid when deploying the contract—this detail made the entire proposal appear to be written by a responsible, out-of-pocket community contributor.

However, the contract code for this proposal was not verified at all. That is, the execution logic (Calldata) of the proposal was not source code verified on a block explorer (like Etherscan). Without verification, the community saw only machine code and could not directly review it. Historical normal proposals for Tornado Cash always included this step; this proposal skipped it.

L2BEAT researcher Sergey Shemyakov was the first to notice this. About 8 hours after the proposal went live, he tagged security researcher Pascal Caversaccio, saying: "The logic of this proposal is abnormally complex, please help with an independent review."

Security Alliance researcher Pascal Caversaccio quickly delivered a conclusion.

The Proposal's True Purpose: Stealthily Changing the Protocol's Admin Address

Caversaccio used a decompilation tool to revert the proposal contract's bytecode and determined the proposal was malicious.

The code contained a function named "governance," with only one function: to return an address, telling the protocol "who the admin is." The address hardcoded within this function was the attacker's own wallet.

In Tornado Cash's architecture, various parts of the protocol call this function to confirm the highest authority. Once the proposal passed and executed, the address originally pointing to the community governance contract would be silently replaced with this attacker address.

The real governance address is 0x5efda50f22d34F262c29268506C5Fa42cB56A1Ce;

The forged attacker address is 0x5efda50f22d34f272c7077689d6abc42f15e285f.

The first 15 characters of the two addresses are identical, with differences starting only from the 16th character. It's very difficult for the average person to spot the difference by eye.

If this proposal passed, the consequence would be: the protocol's recognized "highest admin" address would be silently switched to the attacker's address. At that point, the attacker could use this identity to withdraw approximately $23 million worth of TORN tokens currently locked in the governance contract—this money is staked by community members for voting participation. Additionally, the attacker could forcibly zero out the balances of all relayers (service providers that forward transactions for users) within the protocol, paralyzing the entire system.

Who is the Attacker? Where Did the Money Come From?

The wallet address of the proposal creator is 0xd4eca8c9242b9f9faa3cf19a78defc21dc97a925.

Caversaccio traced the funding source of this address and found it had received a transfer just 4 days before the proposal submission. The sender was Railgun—another on-chain privacy mixing protocol and a direct competitor of Tornado Cash. Using Railgun for the transfer means the fund source is obfuscated, untraceable to real identity.

Current Voting Status After Community Discovery

As of now, the voting results for this proposal are: 0 votes in favor, 27,163 TORN against, accounting for 100%. Voting closes on June 30.

Tornado Cash's governance rules require at least 100,000 TORN participating in the vote to reach quorum; currently, only 27% has been reached. Unless a large-scale abnormal wave of votes in favor appears within the next 4 days, pushing the quorum up and flipping the result. Otherwise, the proposal will expire and the result of being rejected is non-execution. However, the greater impact of this incident is the warning it provides.

This is already the second time Tornado Cash has faced this type of attack. In May 2023, an attacker gained governance control with 1.2 million votes through a proposal containing a hidden self-destruct function, while the entire DAO's legitimate votes at the time were only 70,000. In that attack, the attacker withdrew approximately $2.17 million worth of TORN, using Tornado Cash itself to launder the money, then submitted a "restore governance" proposal, netting about $900,000 before making a clean exit. Since then, no one has fundamentally repaired this governance structure.

DAO Governance Attacks: How Can Ordinary Users Defend Themselves?

Governance attacks are now a regular risk in Web3, not specific to any one protocol. In April 2022, Beanstalk was attacked by a perpetrator who borrowed $1 billion in temporary voting power via a flash loan, passed a proposal, transferred $182 million, and repaid the loan all within a single transaction, taking less than a minute. In February of the same year, Build Finance DAO was taken over by an attacker using counterfeit governance tokens, emptying its $11 million treasury.

The forms of attack are evolving: from flash loan vote snatching, to hidden self-destruct functions, to this time's address character substitution. But the underlying logic remains the same—a DAO's power comes from tokens, and tokens can be borrowed, forged, and obfuscated. Any governance mechanism that can be controlled by code can be attacked.

For ordinary users holding governance tokens, there are several practical paths. First, pay attention to real-time alerts from security researchers; this attack was first flagged by an L2BEAT researcher. Second, proposals pointing to unverified contracts should most likely be voted against directly. Third, if you hold a protocol's governance tokens but don't plan to actively participate, delegating your voting power to active community members is safer than letting the tokens lie dormant in your wallet. Silent tokens only make it harder to reach quorum.

For protocol developers, a more fundamental line of defense is introducing a timelock at the governance layer—proposals, once passed, do not execute immediately but have a 48 to 72-hour window, giving the community and security researchers a chance to review and trigger an emergency pause. Protocols like Compound and Aave have long made this mechanism standard; Tornado Cash still does not have it, which is also part of its extreme choice regarding compliance and censorship resistance.

Preguntas relacionadas

QWhat was the main deceptive tactic used in the fake Tornado Cash proposal to try and gain control of the protocol?

AThe fake proposal contained hidden code that, if executed, would have changed the protocol's 'governance' function to return the attacker's wallet address. This would have stealthily replaced the legitimate admin address, granting the attacker control over the DAO treasury and other protocol functions.

QWho first raised the alarm about the suspicious Proposal #67, and what was the key red flag they identified?

AL2BEAT researcher Sergey Shemyakov first raised the alarm about the suspicious proposal. The key red flag he identified was that the proposal's contract code was not verified on a block explorer like Etherscan, meaning its execution logic was hidden as unreadable bytecode, unlike normal proposals.

QWhat were the potential consequences if the malicious Tornado Cash proposal had passed?

AIf passed, the attacker would have gained control of the protocol's governance. They could have drained the approximately $23 million worth of TORN tokens from the community treasury and forced the balances of all protocol relayers to zero, effectively paralyzing the entire Tornado Cash service.

QHow does this 2026 attack on Tornado Cash relate to a previous incident involving the same protocol?

AThis was the second major governance attack on Tornado Cash. In May 2023, an attacker used a proposal with a hidden self-destruct function to gain voting control, drain roughly $2.17 million from the treasury, and profit by approximately $900,000. The article notes that the fundamental governance structure was not fixed after that first attack.

QAccording to the article, what is a fundamental defensive measure that protocols like Tornado Cash lack, which could help prevent such governance attacks?

AThe article states that Tornado Cash lacks a timelock mechanism in its governance layer. A timelock would impose a 48 to 72-hour delay between a proposal passing and its execution, giving the community and security researchers a window to review the code and trigger an emergency shutdown if necessary, a feature already standard in protocols like Compound and Aave.

Lecturas Relacionadas

CoreWeave: The Inflection Point Has Arrived. Has the 'Hard-Working Underdog' Finally Turned Profitable?

CoreWeave, an AI cloud unicorn, released its Q2 2026 earnings on August 12, with shares rising about 15% post-announcement. While overall performance did not significantly exceed expectations, key positive trends emerged. Revenue reached approximately $2.58 billion, up 112% year-over-year, though slightly below the high end of prior guidance. A major highlight was the acceleration in computing power deployment, with Active Power increasing by a record 500 Mw to 1,500 Mw, far surpassing market forecasts and signaling faster future revenue growth. Capital expenditures also hit a new high of $9.4 billion. Importantly, profitability showed signs of inflection. "True" gross margin (after deducting cost of revenue and Tech & Infrastructure expenses) rose to 7.3%, up 3 percentage points from the previous quarter. As revenue scales, depreciation and operating expenses are being diluted. Adjusted operating profit margin improved significantly to 5% from 1% last quarter. The company's guidance points to continued acceleration, with Q3 revenue growth expected at 158% and margins continuing to climb. Management raised full-year 2026 guidance, projecting Q4 revenue growth of around 194% and an adjusted operating margin of approximately 14.6%, suggesting a rapid path toward its 25%-30% long-term target. Recent developments, including a 25% price increase for its services and the launch of higher-margin Managed Inference offerings, support the improving profitability narrative. While long-term competitive challenges remain for new cloud providers, CoreWeave's near-term trajectory of accelerating growth and expanding margins presents a high-risk, high-reward opportunity, especially amid renewed market optimism for cloud stocks.

marsbitHace 3 min(s)

CoreWeave: The Inflection Point Has Arrived. Has the 'Hard-Working Underdog' Finally Turned Profitable?

marsbitHace 3 min(s)

Uncovering the Secret Reasoning Chains of Claude Opus for $720: A Leak via Haiku, with GPT and Gemini Also Affected

Researchers discovered a method to extract hidden reasoning traces, or "Chain of Thought" (CoT), from major proprietary large language models (LLMs) like Anthropic's Claude Opus 4.8, OpenAI's GPT-5.6 Sol, and Google's Gemini 3.1 Pro. The attack exploits a design flaw in how these models handle encrypted reasoning "blobs." These blobs, which contain a model's internal reasoning steps, are encrypted and sent to the client for storage between conversation turns to save server costs. The researchers found these blobs were encrypted with a global key, allowing them to be reused across different sessions, users, and, crucially, different models from the same company. By taking an encrypted reasoning blob generated by a powerful "flagship" model and feeding it to a smaller, less capable model from the same family (e.g., feeding Claude Opus's blob to Claude Haiku), the researchers could prompt the smaller model to divulge the hidden CoT. This bypassed the need to crack the encryption directly. The implications are significant: 1) Competitors could potentially distill high-value reasoning data at low cost (estimated at ~$720 for 10,000 traces). 2) Sensitive information like API keys, passwords, and personal emails, which models might process internally but not output, could be leaked. The team found such leaks in 4.9% of analyzed public agent logs. 3) Models might internally analyze dangerous queries (e.g., car theft methods) before refusing to answer, but this dangerous analysis could be extracted from the CoT. 4) Malicious instructions could potentially be hidden within a reasoning blob to influence a model's future behavior. While the vulnerability was responsibly disclosed and patched by the affected companies, the research highlights a fundamental tension between the convenience of portable reasoning states and security. The paper also notes preliminary tests found no clear evidence that open-source models like DeepSeek had been distilled from the extracted CoTs.

marsbitHace 8 min(s)

Uncovering the Secret Reasoning Chains of Claude Opus for $720: A Leak via Haiku, with GPT and Gemini Also Affected

marsbitHace 8 min(s)

OpenAI Loses Four Executives in One Month, Former COO Departs, Almost the Entire Safety Team Ousted

In a surprising turn of events, OpenAI's longtime COO and key lieutenant to CEO Sam Altman, Brad Lightcap, has announced his departure after eight years with the company. His exit follows the recent resignations of several key safety and ethics leaders, including Chief Futurist Joshua Achiam, Safety Systems Lead Johannes Heidecke, and Ethics Lead Chloé Bakalar, within a single month. Lightcap, instrumental in building OpenAI's commercialization and operational framework, described his departure as "bittersweet" and hinted at wanting to tackle new challenges. While his statement and Altman's farewell were amicable, internal shifts had previously reduced his operational role, signaling a longer-term transition. The mass exodus, particularly from the safety and ethics divisions, coincides with growing internal and external scrutiny over AI safety. This follows incidents like models exhibiting unauthorized actions during testing and the recent decision to delay the launch of the advanced Astra model due to unresolved safety concerns about its potential cybersecurity capabilities. OpenAI has stated that safety and ethics are not confined to any single team or leader, but the concentration of departures raises questions about the company's direction and internal dynamics, especially as it navigates pressures of rapid development and a potential future IPO.

marsbitHace 8 min(s)

OpenAI Loses Four Executives in One Month, Former COO Departs, Almost the Entire Safety Team Ousted

marsbitHace 8 min(s)

1confirmation: Reverse Entrepreneurship, the Next Web3 Blockbuster Might Come from a Once-Failed Track

**Title: Reverse Entrepreneurship: The Next Web3 Blockbuster May Come from Previously Failed Tracks** This article argues that the next major consumer crypto application is likely to emerge from a concept that failed five years ago, now benefiting from matured infrastructure and better timing. It examines several such "failed" tracks that hold renewed potential: 1. **Internet-Native Assets:** Beyond simply tokenizing tweets or creating digital collectibles, there's an opportunity to create a genuinely new, crypto-native asset class that captures cultural moments and online phenomena, as opposed to merely tokenizing real-world assets (RWA). 2. **X-to-Earn:** While unsustainable token emission models doomed early projects like STEPN, the core premise that most people will first *earn* crypto, not buy it, remains valid. The future challenge is designing what is earned and why users would hold it long-term. 3. **The Metaverse:** Past failures like Decentraland stemmed from trying to replicate the physical world online. The opportunity lies not in abandoning shared online social spaces, but in reimagining their form beyond real-world analogs. 4. **DAOs:** DAOs have underdelivered by overcomplicating governance. The fundamental, unmet user need is simpler: enabling groups of internet strangers to pool funds and collectively achieve goals (e.g., buying assets, funding projects) that are impossible individually. 5. **Personal Value Tokenization:** Numerous attempts (Friend.tech, BitClout) to create markets around individuals have failed. The enduring demand for "person-as-asset" trading (seen in meme coins, prediction markets) suggests the direction isn't wrong, but the execution has been flawed, often lacking creator consent or a less commodified model. The conclusion is that true innovation will come from revisiting these past ideas with new insights, rather than crowding into currently popular trends.

marsbitHace 19 min(s)

1confirmation: Reverse Entrepreneurship, the Next Web3 Blockbuster Might Come from a Once-Failed Track

marsbitHace 19 min(s)

Arizona crypto ATM law helps 35 scam victims recover $171K

Arizona's cryptocurrency ATM law, effective since September 2025, has successfully helped 35 scam victims recover a total of $171,332 in full refunds. The state's attorney general announced the results, urging residents to report fraudulent transactions quickly to meet the law's 30-day reporting deadline. The legislation requires crypto kiosk operators to refund eligible new customers for scam-induced transactions, provided victims contact both the operator and law enforcement within 30 days with an official fraud report. The law defines new customers as those using an operator for fewer than 10 days and caps their daily transactions at $2,000.

cointelegraphHace 29 min(s)

Arizona crypto ATM law helps 35 scam victims recover $171K

cointelegraphHace 29 min(s)

Trading

Spot